Getting Data In

props.conf config for line breaking

ssaenger
Path Finder

Hi All,

I am having problems splitting lines of a log file.
the log entry is below;

[DEBUG 2019-09-26 09:15:57:765] Logger Proxy STARTED
[DEBUG 2019-09-26 09:15:57:765] Logger Servlet Called (13024624) times
[DEBUG 2019-09-26 09:15:57:765] Logger SetResponseDefaults
[FATAL 2019-09-26 09:15:57:765] Logger Proxy - Illegal or missing SubscriberId

below is my props.conf file entry

[jams_log]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = ^[\D{5}\s\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3}]
MAX_TIMESTAMP_LOOKAHEAD = 31
TIME_PREFIX = ^

I thought it was because i did not have TIME_FORMAT, however this did not work either.

any help would be much appreciated.

0 Karma
1 Solution

gcusello
Legend

Hi ssaenger,
at first I suggest to test your props.conf using the guided web interface.
Than, did you tried SHOULD_LINEMERGE=false?
Then I see that the TIME_PREFIX isn't correct, so try something like this:

[jams_log]
SHOULD_LINEMERGE = true
LINE_BREAKER = \[\w+\s+\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}.\d{3}\]
MAX_TIMESTAMP_LOOKAHEAD = 29
TIME_PREFIX = ^\[\w+\s+

Bye.
Giuseppe

View solution in original post

gcusello
Legend

Hi ssaenger,
at first I suggest to test your props.conf using the guided web interface.
Than, did you tried SHOULD_LINEMERGE=false?
Then I see that the TIME_PREFIX isn't correct, so try something like this:

[jams_log]
SHOULD_LINEMERGE = true
LINE_BREAKER = \[\w+\s+\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}.\d{3}\]
MAX_TIMESTAMP_LOOKAHEAD = 29
TIME_PREFIX = ^\[\w+\s+

Bye.
Giuseppe

ssaenger
Path Finder

Thank you Giuseppe,

Yes, from looking at your answer I understand my mistake - slowly learning 🙂

thanks,
Steve

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...